diff --git a/examples/informed-decision-sitting/list_only_records.json b/examples/informed-decision-sitting/list_only_records.json index ec8644f..5278f13 100644 --- a/examples/informed-decision-sitting/list_only_records.json +++ b/examples/informed-decision-sitting/list_only_records.json @@ -1,20 +1,20 @@ { "memo:SECRETS-WP-0010-T03-apply": { - "approval_id": "9935335c-8e9a-566e-a48e-6a5b5f4882eb", + "approval_id": "b5fcbfcc-ad56-456f-bc36-c823052e9917", "binding_digest": "sha256:03cc5b37437f14e86b686ce4054f976556334eff3fa260b03e8014ed3d9217e5", - "memo_version": 2, + "memo_version": 3, "label": "t03-apply" }, "memo:SECRETS-WP-0010-T03-verify": { - "approval_id": "273d6882-6253-5dc9-ac54-544f92ef5e56", + "approval_id": "4e9ff881-d59f-4143-9155-929afbe8dd43", "binding_digest": "sha256:72d9267d038c17107c880ffc9009793ce9c70defbddfe2219628854b811a04b2", - "memo_version": 2, + "memo_version": 3, "label": "t03-verify" }, "memo:SECRETS-WP-0010-T03-exec": { - "approval_id": "7ba0c13b-68cd-5b3e-9481-42ba9e385e68", + "approval_id": "a24e0898-b3c5-4e50-85a8-18a2c2aa229e", "binding_digest": "sha256:f2cf0fb53b740900756ccde5587c3578fcff44beef2f1edab17b9a198a4033d8", - "memo_version": 2, + "memo_version": 3, "label": "t03-exec" } } diff --git a/examples/informed-decision-sitting/policy.md b/examples/informed-decision-sitting/policy.md index 291158a..bb7d665 100644 --- a/examples/informed-decision-sitting/policy.md +++ b/examples/informed-decision-sitting/policy.md @@ -34,7 +34,7 @@ rule, not an extra member of the act set, and it changes nothing else: the same 900-second MFA window. A `list` allow satisfies no other action. - `list` covers the **union** of this package's eight records and the three `SECRETS-WP-0010-T03-*` records from `informed-decision.t03-review`, each - pinned by approval id, binding digest and its own memo version (T03 at 2). + pinned by approval id, binding digest and its own memo version (T03 at 3). Scope stays exact-record: a memo is listable only once someone admitted it. The operator declined resource-type-wide scope because the PDP checks no recipient, and a type-wide rule would have left consumer code — which the @@ -94,24 +94,24 @@ records := { list_only_records := { "memo:SECRETS-WP-0010-T03-apply": { - "approval_id": "9935335c-8e9a-566e-a48e-6a5b5f4882eb", + "approval_id": "b5fcbfcc-ad56-456f-bc36-c823052e9917", "binding_digest": "sha256:03cc5b37437f14e86b686ce4054f976556334eff3fa260b03e8014ed3d9217e5", - "memo_version": 2 + "memo_version": 3 }, "memo:SECRETS-WP-0010-T03-verify": { - "approval_id": "273d6882-6253-5dc9-ac54-544f92ef5e56", + "approval_id": "4e9ff881-d59f-4143-9155-929afbe8dd43", "binding_digest": "sha256:72d9267d038c17107c880ffc9009793ce9c70defbddfe2219628854b811a04b2", - "memo_version": 2 + "memo_version": 3 }, "memo:SECRETS-WP-0010-T03-exec": { - "approval_id": "7ba0c13b-68cd-5b3e-9481-42ba9e385e68", + "approval_id": "a24e0898-b3c5-4e50-85a8-18a2c2aa229e", "binding_digest": "sha256:f2cf0fb53b740900756ccde5587c3578fcff44beef2f1edab17b9a198a4033d8", - "memo_version": 2 + "memo_version": 3 } } # listable is the union list may range over. Sitting records are memo version 1, -# as the act rule pins; T03 records carry their own version (2). +# as the act rule pins; T03 records carry their own version (3). listable := object.union( {id: object.union(r, {"memo_version": 1}) | some id, r in records}, list_only_records, diff --git a/examples/informed-decision-t03/policy.md b/examples/informed-decision-t03/policy.md index 915350a..a389d83 100644 --- a/examples/informed-decision-t03/policy.md +++ b/examples/informed-decision-t03/policy.md @@ -22,7 +22,7 @@ Operator confirmation on 2026-09-14 grants net-kingdom-admins review/bind permission for only the three exact T03 records. The seven already-admitted compact-sitting records are preserved verbatim at memo version 1 because the shared review service currently serves that mandate. T03 renewals require -memo version 2; no existing approval or human entry is copied. The authenticated +memo version 3; no existing approval or human entry is copied. The authenticated informed-decision caller imports signed KeyCape groups and MFA facts. No permission follows from memo content or presentation state. The independent caller binding must be enforced by TokenReview before this package is served. @@ -35,19 +35,19 @@ import rego.v1 records := { "memo:SECRETS-WP-0010-T03-apply": { - "approval_id": "9935335c-8e9a-566e-a48e-6a5b5f4882eb", + "approval_id": "b5fcbfcc-ad56-456f-bc36-c823052e9917", "binding_digest": "sha256:03cc5b37437f14e86b686ce4054f976556334eff3fa260b03e8014ed3d9217e5", - "memo_version": 2 + "memo_version": 3 }, "memo:SECRETS-WP-0010-T03-verify": { - "approval_id": "273d6882-6253-5dc9-ac54-544f92ef5e56", + "approval_id": "4e9ff881-d59f-4143-9155-929afbe8dd43", "binding_digest": "sha256:72d9267d038c17107c880ffc9009793ce9c70defbddfe2219628854b811a04b2", - "memo_version": 2 + "memo_version": 3 }, "memo:SECRETS-WP-0010-T03-exec": { - "approval_id": "7ba0c13b-68cd-5b3e-9481-42ba9e385e68", + "approval_id": "a24e0898-b3c5-4e50-85a8-18a2c2aa229e", "binding_digest": "sha256:f2cf0fb53b740900756ccde5587c3578fcff44beef2f1edab17b9a198a4033d8", - "memo_version": 2 + "memo_version": 3 }, "memo:infd-20260914-c02": { "approval_id": "ccfd8007-2061-48fd-9356-99b16279dac1", diff --git a/examples/informed-decision-t03/records.json b/examples/informed-decision-t03/records.json index 93cd574..a7f73db 100644 --- a/examples/informed-decision-t03/records.json +++ b/examples/informed-decision-t03/records.json @@ -1,6 +1,6 @@ { "memo:SECRETS-WP-0010-T03-apply": { - "approval_id": "9935335c-8e9a-566e-a48e-6a5b5f4882eb", + "approval_id": "b5fcbfcc-ad56-456f-bc36-c823052e9917", "binding_digest": "sha256:03cc5b37437f14e86b686ce4054f976556334eff3fa260b03e8014ed3d9217e5", "action": "apply", "binding": { @@ -24,10 +24,10 @@ } } }, - "memo_version": 2 + "memo_version": 3 }, "memo:SECRETS-WP-0010-T03-verify": { - "approval_id": "273d6882-6253-5dc9-ac54-544f92ef5e56", + "approval_id": "4e9ff881-d59f-4143-9155-929afbe8dd43", "binding_digest": "sha256:72d9267d038c17107c880ffc9009793ce9c70defbddfe2219628854b811a04b2", "action": "verify", "binding": { @@ -53,10 +53,10 @@ } } }, - "memo_version": 2 + "memo_version": 3 }, "memo:SECRETS-WP-0010-T03-exec": { - "approval_id": "7ba0c13b-68cd-5b3e-9481-42ba9e385e68", + "approval_id": "a24e0898-b3c5-4e50-85a8-18a2c2aa229e", "binding_digest": "sha256:f2cf0fb53b740900756ccde5587c3578fcff44beef2f1edab17b9a198a4033d8", "action": "exec", "binding": { @@ -82,6 +82,6 @@ } } }, - "memo_version": 2 + "memo_version": 3 } }